Rootkits – How can you tell whats malicious?

Hello, while i was reading up on rootkits, i was wondering how you would differentiate a malicious rootkit from a non-malicious one?

Thanks!